CVE-2026-71453
MediumCVSS 5.6Summary
An External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 before version 3.0b63 allows path traversal attacks. This allows an attacker to manipulate file paths to access files outside the intended directory.
Risk Assessment
The risk includes unauthorized read or write of system files, potentially leading to data confidentiality breaches, system corruption, or privilege escalation.
Recommendation
It is recommended to update EasyIO FS32 to version 3.0b63 or later and implement path validation to block traversal attempts.
Other vulnerabilities in Johnson Controls EasyIO FS32
See all- CVE-2026-71448Medium
An Insecure Default Initialization of Resource vulnerability in Johnson Controls EasyIO FS32 before version 3.0b63 allows authentication abuse. This may allow an attacker to exploit default settings for unauthorized access.
- CVE-2026-71451Medium
Johnson Controls EasyIO FS32 before version 3.0b63 contains an OS Command Injection vulnerability that allows command injection. An attacker can execute arbitrary commands on the system.
- CVE-2026-27874Medium
Johnson Controls EasyIO FS32 before version 3.0b63 contains a Use of Hard-coded Credentials vulnerability that allows exploitation of default or hard-coded credentials.
Original NVD description (English source)
- External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 allows - traversal attack. This issue affects EasyIO FS32: before 3.0b63.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS